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DETAILED ACTION 

A request for continued examination under 37 CFR 1.1 14, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicants' submission filed on August 20, 2008 has been entered. 

Claims 1, 11, 22, 25, 33, and 41 have been amended. No new 
claims have been added. Claims 1-63 remain pending in the 
application and which have been fully considered by the 
examiner . 

SPECIFICATION 

The specification is objected to as failing to provide 
proper antecedent basis for the claimed subject matter. See 37 
CFR 1.75(d)(1) and MPEP § 608. 01 (o). Correction of the 
following is required: 

Claims 25-32 recite the limitation of " A computer-readable 
medium " , which is not defined in the specification as one of 
ordinary skill in the art would be able to determine the metes 
and bounds of "computer-readable medium." It is unclear what 
Applicants consider as "computer-readable medium." 



Application/Control Number: 10/034,689 Page 3 

Art Unit: 2129 

CLAIM OBJECTIONS 
Claim 11 is objected to because of the following 
informalities : 

• Claim 11 recites in the preamble "The method of claim 
3, wherein sampling the incoming real-time events 
comprises" It should be "The method of claim 3, 
wherein sampling a portion of the incoming real-time 
events . " 

Appropriate correction is required. 

CLAIM REJECTIONS - 35 USC § 112 

The following is a quotation of the first paragraph of 35 
U.S.C. 112: 

The specification shall contain a written description of the invention, and 
of the manner and process of making and using it, in such full, clear, 
concise, and exact terms as to enable any person skilled in the art to 
which it pertains, or with which it is most nearly connected, to make and 
use the same and shall set forth the best mode contemplated by the inventor 
of carrying out his invention. 

Claims 1-63 are rejected under 35 U.S.C. 112, first 
paragraph, as failing to comply with the written description 
requirement. The claim (s) contains subject matter which was not 
described in the specification in such a way as to reasonably 
convey to one skilled in the relevant art that the inventor (s), 
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at the time the application was filed, had possession of the 
claimed invention. 

Claims 1, 11, 22, 25, 33, and 41 recite the new limitation 
"sampling a portion ", which has been found inadequately and/or 
insufficiently disclosed. 

In the remarks, page 16 Applicant cites page 15, line 10 of 
the specification and page 3 lines 15-16 to allegedly support 
the new claimed limitation. However, the cited pages are silent 
about "sampling a portion " . Applicant has not even provided any 
mechanism, structure, or condition on how "sampling a portion" 
is being done. How does applicant determine where the start 
and/or the end of "a portion" are, i.e. what incoming real-time 
events will be included in "a portion". 

CLAIM REJECTIONS - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which 
forms the basis for all obviousness rejections set forth in this 
Office action: 

(a) A patent may not be obtained though the invention is not identically 
disclosed or described as set forth in section 102 of this title, if the 
differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the 
art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere 

Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for 
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establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1. Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and 
the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent 
art. 

4. Considering objective evidence present in the 
application indicating obviousness or nonobviousness . 

This application currently names joint inventors. In 

considering patentability of the claims under 35 U.S.C. 103(a), 

the examiner presumes that the subject matter of the various 

claims was commonly owned at the time any inventions covered 

therein were made absent any evidence to the contrary. 

Applicant is advised of the obligation under 37 CFR 1.56 to 

point out the inventor and invention dates of each claim that 

was not commonly owned at the time a later invention was made in 

order for the examiner to consider the applicability of 35 

U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) prior 

art under 35 U.S.C. 103(a). 

1. Claims 1-18, 22-31, 33-39, 41-58, and 62-63 are rejected under 35 U.S.C. 103(a) as 

being unpatentable over "Computational Intelligence for Distributed Fault Management 
in Networks Using Fuzzy Cognitive Maps", by Ndousse et al, hereinafter Ndousse, and 
further in view of Greineder et al, U. S. Patent No. 6,137,909. 
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Claim 1 

Ndousse teaches a method to diagnose a problem from 
multiple events in a system of managed components generating 
real-time events of problems, comprising: 

forming fuzzy cognitive maps (Ndousse, FCMs , see e.g., 
abstract or Fig. 2) including causally equivalent FCM fragments 
(Ndousse , FCMs inherently comprise of fragments comprising of 
one or more nodes) using network element interdependencies 
derived from a database defining the network managed objects and 
event notifications that convey the state of one or more managed 
objects (Ndousse, title, abstract, page 1559, left col., line 
26, lines 29-30, lines 36-37, page 1558, right col., lines 1-6, 
last 3 lines) ; 

sampling a portion (Greineder, col. 5 lines 49-52) of 
generated incoming real-time events from the system (Ndousse, 
see e.g., time varying aspects, abstract; fault management, 
rapid solution , and/or very rapid detection , page 1558, left 
col., lines 5-36, paragraph I, lines 2-3); and 

diagnosing problems by mapping the sampled events to the 
formed FCM fragments (Ndousse, page 1558, left col., lines 1- 
36) . 

Ndousse teaches substantially all of Applicants' claimed 
invention. Ndousse also teaches sampling generated incoming 
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real-time events from the system. Ndousse fails to particularly 
call for "sampling a portion" (which is not further defined in 
the claims) of events. 

Greineder discloses "sampling a subset of the exemplars 
from each of the event classes" (see e.g., Greineder, col. 5 
lines 49-52) . 

It would have been obvious at the time the invention was 
made to a person having ordinary skill in the art to combine 
Ndousse with Greineder. 

The motivation for doing so would be to differentiate known 
events and unknown events (Greineder, col. 5 lines 30-33). 
Claim 2 

Ndousse in combination with Greineder teach the method of 
claim 1, wherein forming the FCM fragments comprises: 

determining event nodes (Ndousse , event nodes simply read 
on literal events; in a network management or fault management 
system, an event can be a notification that something is wrong 
or that some type of failure occurred, see e.g., fault 
propagation, pgs . 1558-1559) from events in the database 
(Ndousse, page 1558, right col., especially last 4 lines; page 
1559, left col., especially lines 41-42; page 1560 and the 
paragraph under Figure 5) ; 
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identifying concept nodes (Ndousse , concepts , pg. 1559, 
lines 34-41 read on decision points in the FCM, Fig. 2; see also 
concept nodes, under Fig. 5, pg. 1560) from the determined event 
nodes (Ndousse , see how the concepts are determined from the 
actual events of a fault occurring, see "Models of Fault 
Propagation, pgs . 1559-1560 , especially pg . 1559, left col., 
lines 41-42, or pg. 1560, paragraph under Figure 5) ; and 

forming FCM fragments (Ndousse , one or more nodes of an 
FCM) including interdependencies (Ndousse , clearly the concept 
node depend on events/ faults actually occurring or modeling of a 
hypothetical situation where faults occur) between the concept 
and event nodes using the determined event nodes and the 
identified concept nodes (Ndousse, page 1559, left col., lines 
41-42, page 1560, paragraph under Figure 5) . 
Claim 3 

Ndousse in combination with Greineder teach the method of 
claim 2, wherein diagnosing the sampled events comprises: 

mapping the sampled real-time events to the formed FCM 
fragments including determined event nodes to evaluate the 
effect of the mapped event nodes on the identified concept nodes 
using the determined interdependencies (Ndousse , page 1559, 
Figure 2) ; 
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identifying the problems by analyzing the concept nodes 
based on the outcome of the evaluation {Ndousse, e.g., pgs . 
1558-1561, especially pg . 1559, Figure 2); and 

diagnosing the problems based on the outcome of the 
analysis (Ndousse, e.g., page 1559, Figure 2). 
Claim 4 

Ndousse in combination with Greineder teach the method of 
claim 3, wherein the system comprises: 

a system selected from the group consisting of explicit 
system, implicit system, centralized system, partially 
centralized system, and distributed system {Ndousse, see e.g., 
page 1558, or title) . 
Claim 5 

Ndousse in combination with Greineder teach the method of 
claim 3, wherein the events comprise: 

exceptional conditions occurring in the operation of the 
network (Ndousse, e.g., routers failing, links/transmission 
lines failing, page 1558, left col., lines 32-33). 
Claim 6 

Ndousse in combination with Greineder teach the method of 
claim 5, wherein the event nodes comprise: 

significant events selected from the group consisting of 
hardware failures (e.g., a router /l ink) , software failures 
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(Ndousse, e.g., a protocol) , performance bottlenecks (e.g., 
congestion, e.g., Figs. 2-5), configuration problems (Ndousse, 
e.g., links failing) , and security violations (Ndousse, links 
being broken or becoming unsecured, page 1558, left col., lines 
32-33) . 
Claim 7 

Ndousse in combination with Greineder teach the method of 
claim 6, wherein determining the event nodes comprises: 

determining the event nodes from a database defining the 
network managed objects and event notifications that convey the 
state of one or more managed objects. (Examiner interprets the 
database as Management Information Base. Official notice is 
taken that a Management Information Base (MIB) is a set of 
objects that represents various types of information about a 
device, used by a network management protocol to manage the 
device) . 
Claim 8 

Ndousse in combination with Greineder teach the method of 
claim 7, wherein determining the event nodes further comprises: 

determining the event nodes from expert knowledge (not 
further defined) of the network (Ndousse, page 1559, left col., 
lines 1-3) . 
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Claim 9 

Ndousse in combination with Greineder teach the method of 
claim 8, wherein the managed objects comprise: 

objects selected from the group consisting of network 
objects, attached systems, and application objects (Ndousse , 
page 1558, right col., line 10). 
Claim 10 

Ndousse in combination with Greineder teach the method of 
claim 8, wherein the database comprises: 

static information associated with each class of managed or 
dynamic information that affects the causal propagation of 
events (Ndousse, page 1558, right col., last 2 lines). 
(Examiner interprets the database as Management Information 
Base. Official notice is taken that a Management Information 
Base (MIB) is a set of objects that represents various types of 
information about a device, used by a network management 
protocol to manage the device) . 
Claim 11 

Ndousse in combination with Greineder teach the method of 
claim 3, wherein sampling the incoming real-time events 
comprises : 

sampling a portion (Greineder, col. 5 lines 49-52) the 
incoming real-time events sequentially in the order they are 
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received (Ndousse, page 1558, left col., lines 5-36, paragraph 
I, lines 2-3) . 
Claim 12 

Ndousse in combination with Greineder teach the method of 
claim 3, wherein identifying the concept nodes comprises: 

identifying a composite set of events that capture the 
notion of an abstract exception condition in the network 
(Ndousse, e.g., page 1560, Figure 5). 
Claim 13 

Ndousse in combination with Greineder teach the method of 
claim 12, wherein the abstract exception condition comprises: 

abstract exception conditions selected from the group 
consisting of a notion of fault and a notion of performance 
degradation, a network card in a communication system being 
faulty with the number of users being served by the 
communication system drastically reducing, and link between two 
routers going down leading to the use of alternate paths which 
lead to congestion and performance {Ndousse , pgs . 1558-1561 , 
especially page 1561, left col., lines 10-11, 14, right col., 
lines 1-3) . 
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Claim 14 

Ndousse in combination with Greineder teach the method of 
claim 12, wherein capturing (Ndousse, e.g., collecting, polling, 
or determining) the abstract exception condition comprises: 

capturing normal paths based on predetermined criteria on 
which the events have to be diagnosed (Ndousse, page 1558, left 
col . , lines 6-13) . 
Claim 15 

Ndousse in combination with Greineder teach the method of 
claim 14, wherein the criteria comprises: 

causal and temporal inconsistencies between events 
(Ndousse, page 1558, left col., lines 6-13). 
Claim 16 

Ndousse in combination with Greineder teach the method of 
claim 1, wherein forming the FCM, comprises: 

capturing system event interdependencies (Ndousse, page 
1559, left col., lines 36-40). 
Claim 17 

Ndousse in combination with Greineder teach the method of 
claim 15, wherein capturing the system event interdependencies 
comprises : 
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interconnecting event and concept nodes using 

interdependency arcs capturing temporal and logical dependencies 

(Ndousse, page 1559, left col., lines 36-40). 

Claim 18 

Ndousse in combination with Greineder teach the method of 
claim 17, wherein the interdependency arcs comprise: 

weights based on temporal and logical dependencies 
(Ndousse, page 1559, left col., lines 42-45). 
Claim 22 

Ndousse in combination with Greineder teach a method for 
diagnosing problems from multiple events in a communication 
network including managed components generating real-time events 
of problems, comprising: 

forming fuzzy cognitive maps (Ndousse, FCMs , see e.g., 
abstract or Fig. 2) including causally equivalent FCM fragments 
(FCMs inherently comprise of fragments comprising of one or more 
nodes) using network element interdependencies (Ndousse , page 
1559, left col., line 26, lines 29-30, lines 36-37, page 1558, 
right col., lines 1-6, last 3 lines); 

sampling a portion (Greineder, col. 5 lines 49-52) of 
generated incoming real-time events from the network (Ndousse , 
see e.g., time varying aspects, abstract; fault management, 
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rapid solution , and/or very rapid detection , page 1558, left 
col., lines 5-36, paragraph I, lines 2-3); and 

diagnosing each of the problems by mapping the received 
sampled events to the formed FCM fragments (Ndousse , page 1558, 
left col., lines 1-36). 
Claim 23 

Ndousse in combination with Greineder teach the method of claim 22, wherein forming 
the FCM fragments comprises: 

determining event nodes (Ndousse , event nodes simply read 
on literal events; in a network management or fault management 
system, an event can be a notification that something is wrong 
or that some type of failure occurred, see e.g., fault 
propagation, pgs . 1558-1559) from events in the database 
(Ndousse, page 1558, right col., especially last 4 lines; page 
1559, left col., especially lines 41-42; page 1560 and the 
paragraph under Figure 5) ; 

identifying concept nodes (Ndousse , concepts , pg. 1559, 
lines 34-41 read on decision points in the FCM, Fig. 2; see also 
concept nodes, under Fig. 5, pg. 1560) from the determined event 
nodes (see how the concepts are determined from the actual 
events of a fault occurring, see "Models of Fault Propagation , 
pgs. 1559-1560, especially pg. 1559, left col., lines 41-42, or 
pg. 1560, paragraph under Figure 5) ; and 
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forming FCM fragments (Ndousse, one or more nodes of an 

FCM) including interdependencies (Ndousse , clearly the concept 

node depend on events/ faults actually occurring or modeling of a 

hypothetical situation where faults occur) between the concept 

and event nodes using the determined event nodes and the 

identified concept nodes (Ndousse, page 1559, left col., lines 

41-42, page 1560, paragraph under Figure 5) . 

Claim 24 

Ndousse in combination with Greineder teach the method of 
claim 23, wherein diagnosing the sampled events comprises: 

mapping the sampled real-time events to the formed FCM 
fragments including determined event nodes to evaluate the 
effect of the mapped event nodes on the identified concept nodes 
using the determined interdependencies (Ndousse, page 1559, 
Figure 2) ; 

identifying the problems by analyzing the concept nodes 
based on the outcome of the evaluation (Ndousse, e.g., pgs . 
1558-1561, especially pg . 1559, Figure 2); and 

diagnosing the problems based on the outcome of the 
analysis (Ndousse, e.g., page 1559, Figure 2). 
Claim 25 

Ndousse in combination with Greineder teach a computer 
readable medium having computer-executable instructions to 
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diagnose problems from multiple events in a system of managed 
components generating real-time events of problems, comprising 

(Ndousse, page 1562, right col., lines 18-21): 

forming fuzzy cognitive maps (Ndousse, FCMs , see e.g., 
abstract or Fig. 2) including causally equivalent FCM fragments 

(Ndousse , FCMs inherently comprise of fragments comprising of 
one or more nodes) using network element interdependencies 
derived from a database defining the network managed objects and 
event notifications that convey the state of one or more managed 
objects (Ndousse, title, abstract, page 1559, left col., line 
26, lines 29-30, lines 36-37, page 1558, right col., lines 1-6, 
last 3 lines) ; 

sampling a portion (Greineder, col. 5 lines 49-52) 
generated incoming real-time events from the system (Ndousse , 
see e.g., time varying aspects, abstract; fault management, 
rapid solution , and/or very rapid detection , page 1558, left 
col., lines 5-36, paragraph I, lines 2-3); and 

diagnosing problems by mapping the sampled events to the 
formed FCM fragments (Ndousse, page 1558, left col., lines 1- 
36) . 

Claim 26 
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Ndousse in combination with Greineder teach the computer 
readable medium of claim 25, wherein forming the FCM fragments 
comprises : 

determining event nodes (Ndousse , event nodes simply read 
on literal events; in a network management or fault management 
system, an event can be a notification that something is wrong 
or that some type of failure occurred, see e.g., fault 
propagation, pgs . 1558-1559) from events in the database 
(Ndousse, page 1558, right col., especially last 4 lines; page 
1559, left col., especially lines 41-42; page 1560 and the 
paragraph under Figure 5) ; 

identifying concept nodes (Ndousse, concepts, pg . 1559, 
lines 34-41 read on decision points in the FCM, Fig. 2; see also 
concept nodes, under Fig. 5, pg. 1560) from the determined 
event nodes (Ndousse , see how the concepts are determined from 
the actual events of a fault occurring, see "Models of Fault 
Propagation, pgs. 1559-1560, especially pg. 1559, left col., 
lines 41-42, or pg. 1560, paragraph under Figure 5) ; and 

forming FCM fragments (Ndousse, one or more nodes of an 
FCM) including interdependencies (Ndousse , clearly the concept 
node depend on events/ faults actually occurring or modeling of a 
hypothetical situation where faults occur) between the concept 
and event nodes using the determined event nodes and the 
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identified concept nodes (Ndousse, page 1559, left col., lines 
41-42, page 1560, paragraph under Figure 5) . 
Claim 27 

Ndousse in combination with Greineder teach the computer 
readable medium of claim 26, wherein diagnosing the sampled 
events comprises: 

mapping the sampled real-time events to the formed FCM 
fragments including determined event nodes to evaluate the 
effect of the mapped event nodes on the identified concept nodes 
using the determined interdependencies {Ndousse , page 1559, 
Figure 2) ; 

identifying the problems by analyzing the concept nodes 
based on activation levels of the concept nodes {Ndousse, e.g., 
pgs . 1558-1561, especially pg . 1559, Figure 2); and 

diagnosing the problems based on the outcome of the 
analysis {Ndousse, e.g., page 1559, Figure 2). 
Claim 28 

Ndousse in combination with Greineder teach the computer 
readable medium of claim 27, wherein the system comprises: 

a system selected from the group consisting of explicit 
system, implicit system, centralized system, partially 
centralized system, and distributed system {Ndousse, see e.g., 
page 1558, or title) . 
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Claim 29 

Ndousse in combination with Greineder teach the computer 
readable medium of claim 28, wherein the events comprise: 

exceptional conditions occurring in the operation of the 
network (Ndousse, e.g., routers failing, links/transmission 
lines failing, page 1558, left col., lines 32-33). 
Claim 30 

Ndousse in combination with Greineder teach the computer 
readable medium of claim 29, wherein the event nodes comprise: 
significant events selected from the group consisting of 
hardware failures (Ndousse, e.g., a router /l ink) , software 
failures (Ndousse, e.g., a protocol), performance bottlenecks 
(Ndousse, e.g., congestion, e.g., Figs. 2-5), configuration 
problems (Ndousse, e.g., links failing) , and security 
violations (Ndousse , links being broken or becoming unsecured, 
page 1558, left col., lines 32-33). 
Claim 31 

Ndousse in combination with Greineder teach the computer 
readable medium of claim 27, wherein identifying the concept 
nodes comprises: 

identifying a composite set of events that capture the 
notion of an abstract exception condition in the network 
(Ndousse , page 1560 , Figure 5) . 
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Claim 33 

Ndousse in combination with Greineder teach a computer 
system to diagnose problems from multiple events in a system of 
managed components generating real-time events of problems, 
comprising : 

a storage device; 

an output device; and 

a processor programmed to repeatedly perform a method, 
comprising (Ndousse, page 1562, right col., lines 18-21). 

(Software is run on a computer system. Official notice is taken 
that a computer comprises a storage device, an output device, 
and a processor) : 

forming fuzzy cognitive maps (Ndousse, FCMs , see e.g., 
abstract or Fig. 2) including causally equivalent FCM fragments 

(Ndousse , FCMs inherently comprise of fragments comprising of 
one or more nodes) using network element interdependencies 
derived from a database defining the network managed objects and 
event notifications that convey the state of one or more managed 
objects (Ndousse, title, abstract, page 1559, left col., line 
26, lines 29-30, lines 36-31, page 1558, right col., lines 1-6, 
last 3 lines) ; 

sampling a portion of (Greineder, col. 5 lines 49-52) 
generated incoming real-time events from the system (Ndousse , 
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see e.g., time varying aspects, abstract; fault management, 
rapid solution , and/or very rapid detection , page 1558, left 
col., lines 5-36, paragraph I, lines 2-3); and 

diagnosing problems by mapping the sampled events to the 
formed FCM fragments (Ndousse, page 1558, left col., lines 1- 
36) . 
Claim 34 

Ndousse in combination with Greineder teach the system of 
claim 33, wherein forming the FCM fragments comprises: 

determining event nodes (Ndousse , event nodes simply read 
on literal events; in a network management or fault management 
system, an event can be a notification that something is wrong 
or that some type of failure occurred, see e.g., fault 
propagation, pgs . 1558-1559) from events in the database 
(Ndousse, page 1558, right col., especially last 4 lines; page 
1559, left col., especially lines 41-42; page 1560 and the 
paragraph under Figure 5) ; 

identifying concept nodes (Ndousse , concepts , pg. 1559, 
lines 34-41 read on decision points in the FCM, Fig. 2; see also 
concept nodes, under Fig. 5, pg. 1560) from the determined 
event nodes (Ndousse , see how the concepts are determined from 
the actual events of a fault occurring, see "Models of Fault 
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Propagation, pgs. 1559-1599, especially pg. 1559, left col., 
lines 41-42, or pg. 1560, paragraph under Figure 5) ; and 

forming FCM fragments (Ndousse, one or more nodes of an 
FCM) including interdependencies (Ndousse , clearly the concept 
node depend on events/ faults actually occurring or modeling of a 
hypothetical situation where faults occur) between the concept 
and event nodes using the determined event nodes and the 
identified concept nodes (Ndousse, page 1559, left col., lines 
41-42, page 1560, paragraph under Figure 5) . 
Claim 35 

Ndousse in combination with Greineder teach the system of 
claim 34, wherein diagnosing the sampled events comprises: 

mapping the sampled real-time events to the formed FCM 
fragments including determined event nodes to evaluate the 
effect of the mapped event nodes on the identified concept nodes 
using the determined interdependencies (Ndousse, page 1559, 
Figure 2) ; 

identifying the problems by analyzing the concept nodes 
based on the outcome of the evaluation (Ndousse, e.g., pgs. 
1558-1561, especially pg. 1559, Figure 2); and 

diagnosing the problems based on the outcome of the 
analysis (Ndousse, e.g., page 1559, Figure 2). 
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Claim 36 

Ndousse in combination with Greineder teach the system of 
claim 35, wherein the events comprise: 

exceptional conditions occurring in the operation of the 
network (Ndousse, e.g., routers failing, links/transmission 
lines failing, page 1558, left col., lines 32-33). 
Claim 37 

Ndousse in combination with Greineder teach the system of 
claim 35, wherein the event nodes comprise: 

significant events selected from the group consisting of 
hardware failures (Ndousse, e.g., a router /l ink) , software 
failures (Ndousse, e.g., a protocol), performance bottlenecks 
(Ndousse, e.g., congestion, e.g., Figs. 2-5), configuration 
problems (Ndousse, e.g., links failing) , and security 
violations (Ndousse , links being broken or becoming unsecured, 
page 1558, left col., lines 32-33). 
Claim 38 

Ndousse in combination with Greineder teach the system of 
claim 35, wherein identifying the concept nodes comprises: 

identifying a composite set of events that capture the 
notion of an abstract exception condition in the network 
(Ndousse , page 1560, Figure 5) . 
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Claim 39 

Ndousse in combination with Greineder teach the system of 
claim 35, wherein forming the FCM, comprises: 

capturing system event interdependencies by interconnecting 
event and concept nodes using interdependency arcs that capture 
temporal and logical dependencies (Ndousse , page 1559, left 
col . , lines 36-40) . 
Claim 41 

Ndousse in combination with Greineder teach an event- 
correlation system to diagnose problems from multiple incoming 
real-time events in a communication network of managed 
components generating real-time events of problems, comprising: 

an event-analyzer to form fuzzy cognitive maps {Ndousse , 
FCMs , see e.g., abstract or Fig. 2) fragments {Ndousse, FCMs 
inherently comprise of fragments comprising of one or more 
nodes) using network element interdependencies derived from a 
database defining the network managed objects and event 
notifications that convey the state of one or more managed 
objects (Ndousse, title, abstract, page 1559, left col., line 
26, lines 29-30, lines 36-31, page 1558, right col., lines 1-6, 
last 3 lines) ; and 

an event-processing module coupled to the event-analyzer to 
sample a portion of {Greineder, col. 5 lines 49-52) generated 
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incoming real-time events from the network (Ndousse, see e.g., 
time varying aspects, abstract; fault management , rapid 
solution, and/or very rapid detection, page 1558, left col., 
lines 5-36, paragraph I, lines 2-3) , wherein the analyzer to 
diagnose the problems from the sampled events by mapping the 
sampled events to the formed FCM fragments (Ndousse , page 1558, 
left col. , lines 1-36) . 
Claim 42 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 41, wherein the analyzer forms FCM 
fragments by determining event nodes (Ndousse , event nodes 
simply read on literal events; in a network management or fault 
management system, an event can be a notification that something 
is wrong or that some type of failure occurred, see e.g., fault 
propagation , pgs . 1558-1559) from events in the database 
(Ndousse, page 1558, right col., especially last 4 lines; page 
1559, left col., especially lines 41-42; page 1560 and the 
paragraph under Figure 5) , and by further identifying concept 
nodes (Ndousse , concepts , pg. 1559, lines 34-41 read on decision 
points in the FCM, Fig. 2; see also concept nodes, under Fig. 5, 
pg. 1560) from the determined event nodes (Ndousse , see how the 
concepts are determined from the actual events of a fault 
occurring, see "Models of Fault Propagation, pgs. 1559-1599 , 
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especially pg. 1559, left col., lines 41-42, or pg. 1560, 
paragraph under Figure 5) to form FCM fragments (Ndousse , one or 
more nodes of an FCM) including interdependencies (Ndousse , 
clearly the concept node depend on events/ faults actually 
occurring or modeling of a hypothetical situation where faults 
occur) between the identified concept nodes and the determined 
event nodes (Ndousse, page 1559, left col., lines 41-42, page 
1560, paragraph under Figure 5) . 
Claim 43 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 41, wherein the analyzer further 
maps the sampled events to the formed FCM fragments including 
determined event nodes to evaluate the effect of the mapped 
events on the determined concept nodes using the determined 
interdependencies (Ndousse , page 1559, Figure 2) , wherein the 
analyzer identifies the problems by analyzing the concept nodes 
based on the outcome of the evaluation (Ndousse, e.g., pgs . 
1558-1561 , especially pg. 1559, Figure 2) and further diagnoses 
the problems based on the outcome of the analysis (Ndousse , 
e.g., page 1559, Figure 2). 
Claim 44 
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Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, wherein the communication 
network comprises: 

a system selected from the group consisting of explicit 
system, implicit system, centralized system, partially 
centralized system, and distributed system (Ndousse, see e.g., 
page 1558, or title) . 
Claim 45 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, wherein the events comprise: 

exceptional conditions occurring in the operation of the 
network (Ndousse, e.g., routers failing, links/transmission 
lines failing, page 1558, left col., lines 32-33). 
Claim 46 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 45, wherein the event nodes 
comprise : 

significant events selected from the group consisting of 
hardware failures (Ndousse, e.g., a router / link) , software 
failures (Ndousse, e.g., a protocol) , performance bottlenecks 
(Ndousse, e.g., congestion, e.g., Figs. 2-5), configuration 
problems (Ndousse, e.g., links failing) , and security 



Application/Control Number: 10/034,689 Page 29 

Art Unit: 2129 

violations (Ndousse , links being broken or becoming unsecured, 
page 1558, left col., lines 32-33). 
Claim 47 

Ndousse teaches the event-correlation system of claim 46, 
wherein the analyzer determines the event nodes from a database 
defining the network managed-objects and event notifications 
that convey the state of one or more managed objects. (Examiner 
interprets the database as Management Information Base. 
Official notice is taken that a Management Information Base 
(MIB) is a set of objects that represents various types of 
information about a device, used by a network management 
protocol to manage the device) . 
Claim 48 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 47, wherein the analyzer determines 
the event nodes from expert knowledge {not further defined) of 
the network (Ndousse, page 1559, left col., lines 1-3). 
Claim 49 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 48, wherein the managed objects 
comprise : 
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objects selected from the group consisting of network 

objects, attached systems, and application objects (Ndousse , 

page 1558, right col., line 10). 

Claim 50 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 48, wherein the database comprises: 

static information associated with each class of managed 
objects or dynamic information that affects the casual 
propagation of events (Ndousse, page 1558, right col., last 2 
lines) . {Examiner interprets the database as Management 
Information Base. Official notice is taken that a Management 
Information Base (MIB) is a set of objects that represents 
various types of information about a device, used by a network 
management protocol to manage the device) . 
Claim 51 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, further comprising: 

a communication interface module coupled between the 
network and the event-processing module to extract events from 
real-time messages received in different formats from the 
network and to further sample the extracted events seguentially 
in the order they are received (Ndousse, page 1558, left col., 
lines 5-8, paragraph I, lines 2-3) . 
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Claim 52 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, wherein the analyzer identifying 
the concept nodes comprises a composite set of events that 
capture a notion of an abstract exception condition in the 
network (Ndousse, e.g., page 1560, Figure 5). 
Claim 53 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 52, wherein the abstract exception 
condition comprises conditions selected from the group 
consisting of a notion of fault and a notion of performance 
degradation (Ndousse, pgs . 1558-1561, especially page 1561, left 
col., lines 10-11, 14, right col., lines 1-3). 
Claim 54 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 52, wherein the analyzer captures 

(Ndousse, e.g., collecting, polling, or determining) the 
abstract exception condition by capturing normal paths based on 
predetermined criteria from which for the events are diagnosed 

(Ndousse, page 1558, left col., lines 6-10). 
Claim 55 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 54, wherein the criteria comprises: 
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causal and temporal inconsistencies between events 

(Ndousse, page 1558, left col., lines 6-13). 

Claim 56 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, wherein the analyzer forms FCM 
by capturing system event interdependencies (Ndousse , page 1559, 
left col., lines 36-40). 
Claim 57 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 56, wherein the analyzer captures 
system interdependencies by interconnecting event and concept 
nodes using interdependency arcs to capture temporal and logical 
dependencies (Ndousse, page 1559, left col., lines 36-40). 
Claim 58 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 57, wherein the interdependency arcs 
comprise : 

weights based on temporal and logical dependencies 
(Ndousse, page 1559, left col., lines 42-45). 
Claim 62 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 43, further comprising: 
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an interface output module coupled to the event-analyzer to 
output one or more solutions based on the outcome of diagnosing 
the problems by the analyzer (Ndousse, page 1562, right col., 
lines 18-21) . Software is run on a computer system. Official 
notice is taken that a computer comprises a storage device, an 
output device, and a processor. 
Claim 63 

Ndousse in combination with Greineder teach the event- 
correlation system of claim 62, further comprising: 

a memory to store the static and dynamic information. 
Official notice is taken that a computer comprises a memory. 

Claim Rejections - 35 USC §103 
2. Claims 19-21, 32, 40, and 59-61 are rejected under 35 

U.S.C. 103(a) as being unpatentable over the combination of 
Ndousse and Greineder as applied to claims 1-18, 22-31, 33- 
39, 41-58, and 62-63 above, further in view of "Contextual 
Fuzzy Cognitive Map for Decision Support in Geographic 
Information Systems" by Zhi-Qiang Liu et al, hereinafter 
Liu, and further in view of "Cognitive maps and fuzzy 
implications" by Thierry Marchant, hereinafter Marchant. 
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Claim 19 

Ndousse-Greineder disclose substantially all of Applicants' claimed invention with the 
exception of the computation of an indirect effect of events. 

Liu teaches the computation of an indirect effect on concepts in an FCM using the 
claimed equation. 

It would have been obvious at the time the invention was made to a person having 
ordinary skill in the art to modify Ndousse-Greineder as taught by Liu. 

The motivation for doing so would be "for decision support based on the degree to which 
one concept affects another" (Liu, page 502, right col., paragraph IV, lines 2, 12-13). 

The combination of Ndousse, Greineder and Liu does not expressly disclose the 
computation of the bounded difference. 

Marchant teaches the computation of the bounded difference using the claimed equation 
which is the fuzzy equivalents of the AND logical connective of two sets. 

Therefore, it would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to combine Ndousse-Greineder-Liu as taught by Marchant. 

The motivation for doing so would be "in order to find what are the elements of a system 
on which we eventually could act in order to modify the system based on the bound and domain" 
(Marchant, page 634, right col, paragraph 7.1, lines 15-18). 

The method of claim 3, wherein evaluating the effect of the received event nodes on the 
concept nodes, comprises: 
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computing an indirect effect of events (predictive event- 
correlation) on concept nodes using the equations: 

WE,, CO =mm( epx (Ei, Q) = mm(e px H)® « ^Bpx Q) 

(Liu, page 504, right col., lines 10-28) 

wherein the indirect effect of events Ei on concept nodes 
Ci can be defined as the intersection of the linked causal types 
and can be described by the above equation, e px is a function 
which takes I ±j to [0,1] in path x p' i.e. enj = f |x±j), ju± j 

e {0,1}, and © represents a concatenation of paths, wherein the 
concatenation operator © is generally considered as a fuzzy 
x and' operator, wherein the operator (t-norm) for intersection 
of two fuzzy sets other than *min' can be used using a ^bounded 
difference' , wherein the bounded difference can be computed 
using the equation: 

UlipXyL fi to) = max (0, JU,to + jU,to- 1} 

wherein ti() is a t-norm between fuzzy sets A and B with 

membership functions (X A and jj, b - 
Claim 20 

Ndousse-Greineder-Liu-Merchant teach the method of claim 
19, wherein mapping the received real-time events to the formed 
FCM fragments comprises: 
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correlating the received events to the identified concept 
nodes to evaluate the effect of the received event nodes on the 
identified concept nodes using the determined element 
interdependencies (Ndousse, page 1559, Figure 2) . 
Claim 21 

Ndousse-Greineder-Liu-Merchant teach the method of claim 
20, wherein correlating the received events to the concept nodes 
further comprises: 

accumulating evidence based on the received event nodes 
(Ndousse, page 1559, right col.); 

comparing the accumulated evidence to a threshold value 
(Ndousse, page 1559, right col.); and 

analyzing the concept nodes based on the outcome of the 
comparing to evaluate the effect of the received event nodes 
(Ndousse, page 1559, right col.). 
Claim 32 

Ndousse-Greineder-Liu-Merchant teach the computer readable 
medium of claim 27, wherein evaluating the effect of the 
received event nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes 
using the equation: 

I FS (E 1> C i )=inm(^ x (E i) C j ))=miii( e ^ (E^E*))® 

(Liu, page 504, right col., lines 10-28) 
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wherein the indirect effect of events E± on concept nodes 
Ci can be defined as the intersection of the linked causal types 
and can be described by the above equation, e px is a function 
which takes I ±i to [0,1] in path *p' i.e. enj = f ->(I±j, |u±j), ju±j 
e {0,1}, and © represents a concatenation of paths, wherein the 
concatenation operator © is generally considered as a fuzzy 
x and' operator, wherein the operator (t-norm) for intersection 
of two fuzzy sets other than x min' can be used using a ^bounded 
difference' , wherein the bounded difference can be computed 
using the equation: 

Ui^pljJL^)) = max{0, jt^(*)+ flfi) - 1} 
wherein ti() is a t-norm between fuzzy sets A and B with 

membership functions ju A and jj, b - 
Claim 40 

Ndousse-Greineder-Liu-Merchant teach the system of claim 
35, wherein evaluating the effect of the received event nodes on 
the concept nodes, comprises: 

computing an indirect effect of events on concept nodes 
using the equation: 

I cx (E i ,C i )=Bun(g /JJC (E i; Cj)) = min( e ^ x (E b Et)) © ® ™*(e px 

(Liu, page 504, right col., lines 10-28) 
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wherein the indirect effect of events E± on concept nodes 
Ci can be defined as the intersection of the linked causal types 
and can be described by the above equation, e px is a function 
which takes I ±i to [0,1] in path *p' i.e. enj = f ->(I±j, |u±j), ju±j 
e {0,1}, and © represents a concatenation of paths, wherein the 
concatenation operator © is generally considered as a fuzzy 
x and' operator, wherein the operator (t-norm) for intersection 
of two fuzzy sets other than x min' can be used using a ^bounded 
difference' , wherein the bounded difference can be computed 
using the equation: 

Ui^pljJL^)) = max{0, jt^(*)+ flfi) - 1} 
wherein ti() is a t-norm between fuzzy sets A and B with 

membership functions ju A and jj, b - 
Claim 59 

Ndousse-Greineder-Liu-Merchant teach the event-correlation 
system of claim 43, wherein the analyzer evaluates an indirect 
effect of events on concept nodes using the equations: 

l ? M C;) = min( e (E„ Q)) = min( e Ei))© $ mn( g (E to C,)) 

(Liu, page 504, right col., lines 10-28) 

wherein the indirect effect of events E± on concept nodes 
Ci can be defined as the intersection of the linked causal types 
and can be described by the above equation, e px is a function 
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which takes I ± j to [0,1] in path x p' i.e. enj = f ->(I±j, n±j), ju ±j 
e {0,1}, and © represents a concatenation of paths, wherein the 
concatenation operator © is generally considered as a fuzzy 
x and' operator, wherein the operator (t-norm) for intersection 
of two fuzzy sets other than ^min' can be used using a ^bounded 
difference' , wherein the bounded difference can be computed 
using the equation: 

Uli A (■*), \l B to) = max{0, ^ (*) + (*) - 1} 
wherein ti() is a t-norm between fuzzy sets A and B with 
membership functions ju A and \x B . 
Claim 60 

Ndousse-Greineder-Liu-Merchant teach the event-correlation 
system of claim 59, wherein the analyzer maps the received real- 
time events to the formed FCM fragments by correlating the 
received events to the identified concept nodes to evaluate the 
effect of the received event nodes on the identified concept 
nodes using the determined element interdependencies (Ndousse , 
page 1559 , Figure 2) . 
Claim 61 

Ndousse-Greineder-Liu-Merchant teach the event-correlation 
system of claim 59, wherein the analyzer correlates the received 
events by accumulating evidence based on the received event 
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nodes and compares the accumulated evidence to a threshold 
value, and analyzes the concept nodes based on the outcome of 
the comparing to evaluate the effect of the received event nodes 
(Ndousse, page 1559, right col.) 
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